ComplianceAsCode / ComplianceAsCode/content

xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_* report false negative

Open
#8,818 0 comments 0 reactions 0 assignees View on GitHub
Oracle Linux triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:
audit augenrules report false negative result

#### SCAP Security Guide Version:
0.1.62

#### Operating System Version:
Oracle Linux Server release 8.6

#### Steps to Reproduce:

1. Run security check against system with audit rules configured
2.
3.
4.

#### Actual Results:
For example, oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1 reports `failed`. Search pattern is `^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$`, file path is `^/etc/audit/rules\.d/.*\.rules$`
Searching on the system directly shows the audit rule is present:
`[root@c-tso-scap ~]# grep -P '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$' /etc/audit/rules\.d/*.rules`
`/etc/audit/rules.d/perm_mod.rules:-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod`
This seems to apply to all checks in branch "Configure auditd Rules for Comprehensive Auditing"

#### Expected Results:
Check should report "pass"

#### Additional Information/Debugging Steps:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.